Fixing the SSL problems with Git or curl in raspberry PI

I have noticed that on the pi it is possible to have constant problems with git and curl when it comes to https sites. This post addresses the configuration problems and shows you different ways to solve the problem that may suit your particular needs.

Fixing the SSL problems with Git

Out of the box, if you try to commit to a github repository using https (a requirement of github) then you will have difficulties with certificates. The error you will get looks like this (I’m using -v for verbose mode):

1 2 3

root@pi:~# git clone https://github.com/thomasyounsi/sample.git -v Cloning into 'sample'... fatal: unable to access 'https://github.com/thomasyounsi/sample.git/': Problem with the SSL CA cert (path? access rights?)

Solution 1 – The super-easy but bad solution!

Simply use the git global preferences to turn off SSL  verification:

1 2 3 4 5 6 7 8 9

root@pi:~# git config --global http.sslVerify false root@pi:~# git clone https://github.com/thomasyounsi/sample.git -v Cloning into 'sample'... POST git-upload-pack (190 bytes) remote: Counting objects: 31, done. remote: Compressing objects: 100% (23/23), done. remote: Total 31 (delta 15), reused 18 (delta 7) Unpacking objects: 100% (31/31), done. root@pi:~#

A git push will work with this solution:

1 2 3 4 5 6 7 8 9

root@pi:~/sample# git push https://user@github.com/thomasyounsi/sample.git Password for 'https://user@github.com': Counting objects: 5, done. Compressing objects: 100% (3/3), done. Writing objects: 100% (3/3), 308 bytes | 0 bytes/s, done. Total 3 (delta 2), reused 0 (delta 0) To https://user@github.com/thomasyounsi/sample.git 6d24b8a..89bcc1c master -> master root@pi:~/sample#

The downside? Well what is the point in using https if you have turned off SSL verification… This solution is not recommended as it leaves you vulnerable to man-in-the-middle attacks.

Solution 2 – The definitely-better Solution!

For the test below, I reset SSL verification to be on, so:

1	root@pi:~# git config --global http.sslVerify true

Make sure that your ca-certificates (certification authority certificates! wow!) package is up to date:

1	root@pi:~#opkg install ca-certificates

Now edit your .gitcofig, which is a hidden file in your home directory (works for all user accounts including root) – If it doesn’t exist on your account, create it:

1 2 3 4

root@pi:~# cd ~/ root@pi:~# ls .git* -l -rw-r--r-- 1 root root 82 Jun 5 11:58 .gitconfig root@pi:~# vi .gitconfig

Change your .gitconfig settings for [http] to be like mine:

1 2 3 4 5 6

[http] sslVerify = true sslCAinfo = /etc/ssl/certs/ca-certificates.crt [user] email = user@myemaildomain.com name = thomasyounsi

Where sslCAinfo is the important field to set. Replace the [user] details with your own details.

Now, cloning a repository…

1 2 3 4 5 6 7

root@pi:~# git clone https://github.com/thomasyounsi/sample.git Cloning into 'sample'... remote: Counting objects: 34, done. remote: Compressing objects: 100% (25/25), done. remote: Total 34 (delta 17), reused 21 (delta 8) Unpacking objects: 100% (34/34), done. root@pi:~#

And pushing to the repository is working fine too.

1 2 3 4 5 6 7 8 9 10

root@pi:~/sample# git push Username for 'https://github.com': thomasyounsi Password for 'https://thomasyounsi@github.com': Counting objects: 5, done. Compressing objects: 100% (3/3), done. Writing objects: 100% (3/3), 301 bytes | 0 bytes/s, done. Total 3 (delta 2), reused 0 (delta 0) To https://github.com/thomasyounsi/sample.git 89bcc1c..7d1a5c6 master -> master root@pi:~/sample#

Everything is working.

Fixing SSL Problems with Curl

Similar problems arise with curl – For example:

1 2 3 4 5

root@pi:~/temp# curl https://raw.github.com/thomasyounsi/sample/master/sample.cpp > test.cpp % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 curl: (77) Problem with the SSL CA cert (path? access rights?)

Again there are multiple solutions:

Solution 1 – Turn off certificates

The first is to simply turn off certificates using the curl -k option, so:

1 2 3 4

root@pi:~/temp# curl -k https://raw.github.com/thomasyounsi/sample/master/sample.cpp > test.cpp % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 991 100 991 0 0 2921 0 --:--:-- --:--:-- --:--:-- 3753

Again, this is not a good solution as it leaves you vulnerable to man-in-the-middle attacks.

Solution 1b – Turn off certificates to make it compatible with third party script like

rpi-source or rpi-update which auto update the script so you can't add -k option in front of all calls to curl

To make it persistent when curl to keep third party script happy is to intercepts curl calls using a shell script

1 2 3 4 5 6 7

cp /usr/bin/curl /usr/bin/curl.bin cd /usr/bin/ sudo vi curl #!/bin/sh /usr/bin/curl.bin –k $1 $2 $3 $4 $5 $6 $7 $8 $9 $10 $11 :w! chmod +x /usr/bin/curl

 Solution 2 – Better – Fix the certificates problem at the Command Line

Again (in case you didn’t address git above), check that your ca-certificates package is up to date. You can then specify at the command line the cacert file using “–cacert /etc/ssl/certs/ca-certificates.crt“. It’s a bit verbose to do every time.

1 2 3 4

root@pi:~/temp# curl --cacert /etc/ssl/certs/ca-certificates.crt https://raw.github.com/thomasyounsi/sample/master/sample.cpp > test.cpp % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 991 100 991 0 0 720 0 0:00:01 0:00:01 --:--:-- 769

 Solution 3 – Best – Fix it using an environment variable

Effectively we can set the certs bundle in Solution 2 using an environment variable, which allows us to set this value on boot. So,

1 2 3 4 5 6 7 8 9 10

root@pi:~/temp# export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt root@pi:~/temp# echo $CURL_CA_BUNDLE /etc/ssl/certs/ca-certificates.crt root@pi:~/temp# cat $CURL_CA_BUNDLE -----BEGIN CERTIFICATE----- MIIHWTCCBUGgAwIBAgIDCkGKMA0GCSqGSIb3DQEBCwUAMHkxEDAOBgNVBAoTB1Jv ... d+pLncdBu8fA46A/5H2kjXPmEkvfoXNzczqA6NXLji/L6hOn1kGLrPo8idck9U60 4GGSt/M3mMS+lqO3ig== -----END CERTIFICATE-----

Once you have set this environment variable, you can just use curl with no flags:

1 2 3 4

root@pi:~/temp# curl https://raw.github.com/thomasyounsi/sample/master/sample.cpp > test1.cpp % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 991 100 991 0 0 728 0 0:00:01 0:00:01 --:--:-- 774

All is in order now for both git and curl.

Finally we want to set this so that the environment variable is set on boot for the current user (root) – First we need to determine which shell we are currently using. For this we can do two things:

1 2 3 4 5

root@pi:~# ps -p $$ PID TTY TIME CMD 620 pts/0 00:00:00 sh root@pi:~# echo $SHELL /bin/sh

So, clearly we are using sh, which means that we use a .profile file in our home directory; so, we could do a vi .profile and add the following text (to anything that is already there):

1	export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

Then, just to check on reboot:

1 2 3 4

root@pi:~# reboot ... root@pi:~# echo $CURL_CA_BUNDLE /etc/ssl/certs/ca-certificates.crt

Finally, if you wish to generate new CA-certificates then you should have a look at the guides at: http://curl.haxx.se/docs/sslcerts.html